#include "app-layer-protos.h"

Include dependency graph for app-layer-detect-proto.h:

This graph shows which files directly or indirectly include this file:

Typedefs
typedef struct Flow_	Flow

typedef struct AppLayerProtoDetectThreadCtx_	AppLayerProtoDetectThreadCtx

typedef AppProto(*	ProbingParserFPtr) (const Flow f, uint8_t flags, const uint8_t input, uint32_t input_len, uint8_t *rdir)

Functions
AppProto	AppLayerProtoDetectGetProto (AppLayerProtoDetectThreadCtx tctx, Flow f, const uint8_t buf, uint32_t buflen, uint8_t ipproto, uint8_t flags, bool reverse_flow)
	Returns the app layer protocol given a buffer. More...

int	AppLayerProtoDetectPrepareState (void)
	Prepares the internal state for protocol detection. This needs to be called once all the patterns and probing parser ports have been registered. More...

void	SCAppLayerProtoDetectPPRegister (uint8_t ipproto, const char *portstr, AppProto alproto, uint16_t min_depth, uint16_t max_depth, uint8_t direction, ProbingParserFPtr ProbingParser1, ProbingParserFPtr ProbingParser2)
	register parser at a port More...

int	SCAppLayerProtoDetectPPParseConfPorts (const char ipproto_name, uint8_t ipproto, const char alproto_name, AppProto alproto, uint16_t min_depth, uint16_t max_depth, ProbingParserFPtr ProbingParserTs, ProbingParserFPtr ProbingParserTc)

int	SCAppLayerProtoDetectPMRegisterPatternCS (uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction)
	Registers a case-sensitive pattern for protocol detection. More...

int	SCAppLayerProtoDetectPMRegisterPatternCSwPP (uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction, ProbingParserFPtr PPFunc, uint16_t pp_min_depth, uint16_t pp_max_depth)

int	SCAppLayerProtoDetectPMRegisterPatternCI (uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction)
	Registers a case-insensitive pattern for protocol detection. More...

int	SCAppLayerProtoDetectPMRegisterPatternCIwPP (uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction, ProbingParserFPtr PPFunc, uint16_t pp_min_depth, uint16_t pp_max_depth)

int	AppLayerProtoDetectSetup (void)
	The first function to be called. This initializes a global protocol detection context. More...

void	AppLayerProtoDetectReset (Flow *)
	Reset proto detect for flow. More...

bool	AppLayerRequestProtocolChange (Flow *f, uint16_t dp, AppProto expect_proto)
	request applayer to wrap up this protocol and rerun protocol detection. More...

bool	SCAppLayerRequestProtocolTLSUpgrade (Flow *f)
	request applayer to wrap up this protocol and rerun protocol detection with expectation of TLS. Used by STARTTLS. More...

void	SCAppLayerForceProtocolChange (Flow *f, AppProto new_proto)
	Forces a flow app-layer protocol change. Happens for instance when a HTTP2 flow is seen as DOH2. More...

int	AppLayerProtoDetectDeSetup (void)
	Cleans up the app layer protocol detection phase. More...

void	AppLayerProtoDetectRegisterProtocol (AppProto alproto, const char *alproto_name)
	Registers a protocol for protocol detection phase. More...

void	AppLayerProtoDetectRegisterAlias (const char proto_name, const char proto_alias)

int	SCAppLayerProtoDetectConfProtoDetectionEnabled (const char ipproto, const char alproto)
	Given a protocol name, checks if proto detection is enabled in the conf file. More...

int	SCAppLayerProtoDetectConfProtoDetectionEnabledDefault (const char ipproto, const char alproto, bool default_enabled)
	Given a protocol name, checks if proto detection is enabled in the conf file. More...

AppLayerProtoDetectThreadCtx *	AppLayerProtoDetectGetCtxThread (void)
	Inits and returns an app layer protocol detection thread context. More...

void	AppLayerProtoDetectDestroyCtxThread (AppLayerProtoDetectThreadCtx *tctx)
	Destroys the app layer protocol detection thread context. More...

void	AppLayerProtoDetectSupportedIpprotos (AppProto alproto, uint8_t *ipprotos)

AppProto	AppLayerProtoDetectGetProtoByName (const char *alproto_name)

const char *	AppLayerProtoDetectGetProtoName (AppProto alproto)

void	AppLayerProtoDetectSupportedAppProtocols (AppProto *alprotos)

void	AppLayerRegisterExpectationProto (uint8_t proto, AppProto alproto)

void	AppProtoDetectListNames (void)

bool	AppLayerProtoDetectHasProbingParsers (uint8_t ipproto, uint16_t port, AppProto alproto)

void	AppLayerProtoDetectUnittestCtxBackup (void)
	Backs up the internal context used by the app layer proto detection module. More...

void	AppLayerProtoDetectUnittestCtxRestore (void)
	Restores back the internal context used by the app layer proto detection module, that was previously backed up by calling AppLayerProtoDetectUnittestCtxBackup(). More...

void	AppLayerProtoDetectUnittestsRegister (void)
	Register unittests for app layer proto detection module. More...

Detailed Description

Author: Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t; Anoop Saldanha anoop.nosp@m.sald.nosp@m.anha@.nosp@m.gmai.nosp@m.l.com

Definition in file app-layer-detect-proto.h.

Typedef Documentation

◆ AppLayerProtoDetectThreadCtx

typedef struct AppLayerProtoDetectThreadCtx_ AppLayerProtoDetectThreadCtx

Definition at line 1 of file app-layer-detect-proto.h.

◆ Flow

typedef struct Flow_ Flow

Definition at line 1 of file app-layer-detect-proto.h.

◆ ProbingParserFPtr

typedef AppProto(* ProbingParserFPtr) (const Flow *f, uint8_t flags, const uint8_t *input, uint32_t input_len, uint8_t *rdir)

Definition at line 34 of file app-layer-detect-proto.h.

Function Documentation

◆ AppLayerProtoDetectDeSetup()

int AppLayerProtoDetectDeSetup ( void )

Cleans up the app layer protocol detection phase.

Todo:: incomplete. Need more work.

Definition at line 1743 of file app-layer-detect-proto.c.

References FLOW_PROTO_DEFAULT, PatIntId, and SCEnter.

Referenced by AppLayerDeSetup().

Here is the caller graph for this function:

◆ AppLayerProtoDetectDestroyCtxThread()

void AppLayerProtoDetectDestroyCtxThread ( AppLayerProtoDetectThreadCtx * tctx )

Destroys the app layer protocol detection thread context.

Parameters

tctx	Pointer to the app layer protocol detection thread context.

Definition at line 2040 of file app-layer-detect-proto.c.

References FLOW_PROTO_DEFAULT, and SCEnter.

Referenced by AppLayerDestroyCtxThread().

Here is the caller graph for this function:

◆ AppLayerProtoDetectGetCtxThread()

AppLayerProtoDetectThreadCtx* AppLayerProtoDetectGetCtxThread ( void )

Inits and returns an app layer protocol detection thread context.

Parameters

ctx	Pointer to the app layer protocol detection context.

Return values

Pointer to the thread context, on success; NULL, on failure.

Definition at line 1987 of file app-layer-detect-proto.c.

References alpd_tctx, FLOW_PROTO_DEFAULT, PatIntId, and SCEnter.

Referenced by AppLayerGetCtxThread(), and LLVMFuzzerTestOneInput().

Here is the caller graph for this function:

◆ AppLayerProtoDetectGetProto()

AppProto AppLayerProtoDetectGetProto	(	AppLayerProtoDetectThreadCtx *	tctx,
		Flow *	f,
		const uint8_t *	buf,
		uint32_t	buflen,
		uint8_t	ipproto,
		uint8_t	flags,
		bool *	reverse_flow
	)

Returns the app layer protocol given a buffer.

Parameters

	tctx	Pointer to the app layer protocol detection thread context.
	f	Pointer to the flow.
	buf	The buffer to be inspected.
	buflen	The length of the above buffer.
	ipproto	The ip protocol.
	flags	The direction bitfield - STREAM_TOSERVER/STREAM_TOCLIENT.
[out]	reverse_flow	true if flow is detected to be reversed

Return values

The	app layer protocol.

Definition at line 1409 of file app-layer-detect-proto.c.

References ALPROTO_UNKNOWN, flags, FLOW_IS_PM_DONE, g_alproto_max, SCEnter, and SCLogDebug.

Referenced by AppLayerHandleUdp(), and LLVMFuzzerTestOneInput().

Here is the caller graph for this function:

◆ AppLayerProtoDetectGetProtoByName()

AppProto AppLayerProtoDetectGetProtoByName ( const char * alproto_name )

Definition at line 2086 of file app-layer-detect-proto.c.

References SCEnter.

Referenced by AppLayerGetProtoByName().

Here is the caller graph for this function:

◆ AppLayerProtoDetectGetProtoName()

const char* AppLayerProtoDetectGetProtoName ( AppProto alproto )

Definition at line 2111 of file app-layer-detect-proto.c.

References ALPROTO_HTTP.

Referenced by AppLayerGetProtoName().

Here is the caller graph for this function:

◆ AppLayerProtoDetectHasProbingParsers()

bool AppLayerProtoDetectHasProbingParsers	(	uint8_t	ipproto,
		uint16_t	port,
		AppProto	alproto
	)

Definition at line 463 of file app-layer-detect-proto.c.

◆ AppLayerProtoDetectPrepareState()

int AppLayerProtoDetectPrepareState ( void )

Prepares the internal state for protocol detection. This needs to be called once all the patterns and probing parser ports have been registered.

Definition at line 1497 of file app-layer-detect-proto.c.

References FLOW_PROTO_DEFAULT, and SCEnter.

◆ AppLayerProtoDetectRegisterAlias()

void AppLayerProtoDetectRegisterAlias	(	const char *	proto_name,
		const char *	proto_alias
	)

Definition at line 1802 of file app-layer-detect-proto.c.

References AppLayerProtoDetectAliases_::next, AppLayerProtoDetectAliases_::proto_alias, AppLayerProtoDetectAliases_::proto_name, SCEnter, SCMalloc, and unlikely.

Referenced by SCAppLayerRegisterParserAlias().

Here is the caller graph for this function:

◆ AppLayerProtoDetectRegisterProtocol()

void AppLayerProtoDetectRegisterProtocol	(	AppProto	alproto,
		const char *	alproto_name
	)

Registers a protocol for protocol detection phase.

   This is the first function to be called after calling the
   setup function, AppLayerProtoDetectSetup(), before calling any other
   app layer functions, AppLayerParser or AppLayerProtoDetect, alike.
   With this function you are associating/registering a string
   that can be used by users to write rules, i.e.
   you register the http protocol for protocol detection using
   AppLayerProtoDetectRegisterProtocol(ctx, ALPROTO_HTTP1, "http"),
   following which you can write rules like -
   alert http any any -> any any (sid:1;)
   which basically matches on the HTTP protocol.

Parameters

alproto	The protocol.
alproto_str	The string to associate with the above "alproto". Please send a static string that won't be destroyed post making this call, since this function won't create a copy of the received argument.

Return values

0	On success; -1 On failure.

Definition at line 1782 of file app-layer-detect-proto.c.

References SCEnter.

Referenced by RegisterDNP3Parsers(), RegisterFTPParsers(), RegisterHTPParsers(), RegisterHTTP2Parsers(), RegisterIMAPParsers(), RegisterSMTPParsers(), RegisterSSHParsers(), RegisterSSLParsers(), and RegisterTFTPParsers().

Here is the caller graph for this function:

◆ AppLayerProtoDetectReset()

void AppLayerProtoDetectReset ( Flow * )

Reset proto detect for flow.

Definition at line 1894 of file app-layer-detect-proto.c.

References Flow_::alparser, Flow_::alproto, Flow_::alproto_tc, Flow_::alproto_ts, ALPROTO_UNKNOWN, FLOW_RESET_PE_DONE, FLOW_RESET_PM_DONE, FLOW_RESET_PP_DONE, Flow_::probing_parser_toclient_alproto_masks, and Flow_::probing_parser_toserver_alproto_masks.

◆ AppLayerProtoDetectSetup()

int AppLayerProtoDetectSetup ( void )

The first function to be called. This initializes a global protocol detection context.

Return values

0	On success;
-1	On failure.

Definition at line 1686 of file app-layer-detect-proto.c.

References SCEnter.

◆ AppLayerProtoDetectSupportedAppProtocols()

void AppLayerProtoDetectSupportedAppProtocols ( AppProto * alprotos )

Definition at line 2128 of file app-layer-detect-proto.c.

References g_alproto_max, and SCEnter.

Referenced by AppLayerListSupportedProtocols(), AppLayerRegisterThreadCounters(), ListAppLayerFrames(), and ListAppLayerHooks().

Here is the caller graph for this function:

◆ AppLayerProtoDetectSupportedIpprotos()

void AppLayerProtoDetectSupportedIpprotos	(	AppProto	alproto,
		uint8_t *	ipprotos
	)

Definition at line 2066 of file app-layer-detect-proto.c.

References ALPROTO_DOH2, ALPROTO_HTTP, ALPROTO_HTTP1, ALPROTO_HTTP2, AppLayerProtoDetectSupportedIpprotos(), and SCEnter.

Referenced by AppLayerProtoDetectSupportedIpprotos().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ AppLayerProtoDetectUnittestCtxBackup()

void AppLayerProtoDetectUnittestCtxBackup ( void )

Backs up the internal context used by the app layer proto detection module.

Definition at line 2177 of file app-layer-detect-proto.c.

References SCEnter.

◆ AppLayerProtoDetectUnittestCtxRestore()

void AppLayerProtoDetectUnittestCtxRestore ( void )

Restores back the internal context used by the app layer proto detection module, that was previously backed up by calling AppLayerProtoDetectUnittestCtxBackup().

Definition at line 2185 of file app-layer-detect-proto.c.

References SCEnter.

◆ AppLayerProtoDetectUnittestsRegister()

void AppLayerProtoDetectUnittestsRegister ( void )

Register unittests for app layer proto detection module.

Definition at line 3548 of file app-layer-detect-proto.c.

References SCEnter, and UtRegisterTest().

Here is the call graph for this function:

◆ AppLayerRegisterExpectationProto()

void AppLayerRegisterExpectationProto	(	uint8_t	proto,
		AppProto	alproto
	)

Definition at line 2158 of file app-layer-detect-proto.c.

◆ AppLayerRequestProtocolChange()

bool AppLayerRequestProtocolChange	(	Flow *	f,
		uint16_t	dp,
		AppProto	expect_proto
	)

request applayer to wrap up this protocol and rerun protocol detection.

When this is called, the old session is reset unconditionally. A 'detect/log' flush packet is generated for both direction before the reset, so allow for final detection and logging.

Parameters

f	flow to act on
dp	destination port to use in protocol detection. Set to 443 for start tls, set to the HTTP uri port for CONNECT and set to 0 to not use it.
expect_proto	expected protocol. AppLayer event will be set if detected protocol differs from this.

Definition at line 1842 of file app-layer-detect-proto.c.

References Flow_::alproto, Flow_::alproto_expect, Flow_::alproto_orig, Flow_::alproto_tc, Flow_::alproto_ts, ALPROTO_UNKNOWN, DEBUG_VALIDATE_BUG_ON, FlowChangeProto(), FlowSetChangeProtoFlag(), and Flow_::protodetect_dp.

Referenced by SCAppLayerRequestProtocolTLSUpgrade().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ AppProtoDetectListNames()

void AppProtoDetectListNames ( void )

Definition at line 1724 of file app-layer-detect-proto.c.

Referenced by DetectListSupportedProtocols().

Here is the caller graph for this function:

◆ SCAppLayerForceProtocolChange()

void SCAppLayerForceProtocolChange	(	Flow *	f,
		AppProto	new_proto
	)

Forces a flow app-layer protocol change. Happens for instance when a HTTP2 flow is seen as DOH2.

Parameters

f	flow to act on
new_proto	new app-layer protocol

Definition at line 1884 of file app-layer-detect-proto.c.

References Flow_::alproto, Flow_::alproto_orig, Flow_::alproto_tc, and Flow_::alproto_ts.

◆ SCAppLayerProtoDetectConfProtoDetectionEnabled()

int SCAppLayerProtoDetectConfProtoDetectionEnabled	(	const char *	ipproto,
		const char *	alproto
	)

Given a protocol name, checks if proto detection is enabled in the conf file.

Parameters

alproto Name of the app layer protocol.

Return values

1	If enabled.
0	If disabled.

Definition at line 1982 of file app-layer-detect-proto.c.

References SCAppLayerProtoDetectConfProtoDetectionEnabledDefault().

Referenced by HTPFreeConfig(), RegisterFTPParsers(), RegisterHTPParsers(), RegisterIMAPParsers(), RegisterNFSTCPParsers(), RegisterSMTPParsers(), RegisterSSHParsers(), RegisterSSLParsers(), and RegisterTFTPParsers().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ SCAppLayerProtoDetectConfProtoDetectionEnabledDefault()

int SCAppLayerProtoDetectConfProtoDetectionEnabledDefault	(	const char *	ipproto,
		const char *	alproto,
		bool	default_enabled
	)

Given a protocol name, checks if proto detection is enabled in the conf file.

Parameters

alproto	Name of the app layer protocol.
default_enabled	enable by default if not in the configuration file

Return values

1	If enabled.
0	If disabled.

Definition at line 1912 of file app-layer-detect-proto.c.

References BUG_ON, FatalError, RunmodeIsUnittests(), SCConfGetNode(), SCConfValIsFalse(), SCConfValIsTrue(), SCEnter, SCLogDebug, SCLogError, SCReturnInt, and SCConfNode_::val.

Referenced by RegisterDNP3Parsers(), RegisterHTTP2Parsers(), and SCAppLayerProtoDetectConfProtoDetectionEnabled().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ SCAppLayerProtoDetectPMRegisterPatternCI()

int SCAppLayerProtoDetectPMRegisterPatternCI	(	uint8_t	ipproto,
		AppProto	alproto,
		const char *	pattern,
		uint16_t	depth,
		uint16_t	offset,
		uint8_t	direction
	)

Registers a case-insensitive pattern for protocol detection.

Definition at line 1673 of file app-layer-detect-proto.c.

References SCEnter.

◆ SCAppLayerProtoDetectPMRegisterPatternCIwPP()

int SCAppLayerProtoDetectPMRegisterPatternCIwPP	(	uint8_t	ipproto,
		AppProto	alproto,
		const char *	pattern,
		uint16_t	depth,
		uint16_t	offset,
		uint8_t	direction,
		ProbingParserFPtr	PPFunc,
		uint16_t	pp_min_depth,
		uint16_t	pp_max_depth
	)

Definition at line 1663 of file app-layer-detect-proto.c.

References SCEnter.

◆ SCAppLayerProtoDetectPMRegisterPatternCS()

int SCAppLayerProtoDetectPMRegisterPatternCS	(	uint8_t	ipproto,
		AppProto	alproto,
		const char *	pattern,
		uint16_t	depth,
		uint16_t	offset,
		uint8_t	direction
	)

Registers a case-sensitive pattern for protocol detection.

Definition at line 1640 of file app-layer-detect-proto.c.

References SCEnter.

◆ SCAppLayerProtoDetectPMRegisterPatternCSwPP()

int SCAppLayerProtoDetectPMRegisterPatternCSwPP	(	uint8_t	ipproto,
		AppProto	alproto,
		const char *	pattern,
		uint16_t	depth,
		uint16_t	offset,
		uint8_t	direction,
		ProbingParserFPtr	PPFunc,
		uint16_t	pp_min_depth,
		uint16_t	pp_max_depth
	)

Definition at line 1651 of file app-layer-detect-proto.c.

References SCEnter.

◆ SCAppLayerProtoDetectPPParseConfPorts()

int SCAppLayerProtoDetectPPParseConfPorts	(	const char *	ipproto_name,
		uint8_t	ipproto,
		const char *	alproto_name,
		AppProto	alproto,
		uint16_t	min_depth,
		uint16_t	max_depth,
		ProbingParserFPtr	ProbingParserTs,
		ProbingParserFPtr	ProbingParserTc
	)

Return values

bool	0 if no config was found, 1 if config was found

Definition at line 1577 of file app-layer-detect-proto.c.

References FatalError, SCAppLayerProtoDetectPPRegister(), SCConfGetNode(), SCConfNodeLookupChild(), SCEnter, SCLogDebug, SCReturnInt, and SCConfNode_::val.

Here is the call graph for this function:

◆ SCAppLayerProtoDetectPPRegister()

void SCAppLayerProtoDetectPPRegister	(	uint8_t	ipproto,
		const char *	portstr,
		AppProto	alproto,
		uint16_t	min_depth,
		uint16_t	max_depth,
		uint8_t	direction,
		ProbingParserFPtr	ProbingParser1,
		ProbingParserFPtr	ProbingParser2
	)

register parser at a port

Parameters

direction STREAM_TOSERVER or STREAM_TOCLIENT for dp or sp

Definition at line 1541 of file app-layer-detect-proto.c.

References head, and SCEnter.

Referenced by RegisterDNP3Parsers(), RegisterTFTPParsers(), and SCAppLayerProtoDetectPPParseConfPorts().

Here is the caller graph for this function:

◆ SCAppLayerRequestProtocolTLSUpgrade()

bool SCAppLayerRequestProtocolTLSUpgrade ( Flow * f )

request applayer to wrap up this protocol and rerun protocol detection with expectation of TLS. Used by STARTTLS.

Sets detection port to 443 to make port based TLS detection work for SMTP, FTP etc as well.

Parameters

f	flow to act on

Definition at line 1873 of file app-layer-detect-proto.c.

References ALPROTO_TLS, and AppLayerRequestProtocolChange().

Here is the call graph for this function:

Typedefs

Functions

Detailed Description

Typedef Documentation

◆ AppLayerProtoDetectThreadCtx

◆ Flow

◆ ProbingParserFPtr

Function Documentation

◆ AppLayerProtoDetectDeSetup()

◆ AppLayerProtoDetectDestroyCtxThread()

◆ AppLayerProtoDetectGetCtxThread()

◆ AppLayerProtoDetectGetProto()

◆ AppLayerProtoDetectGetProtoByName()

◆ AppLayerProtoDetectGetProtoName()

◆ AppLayerProtoDetectHasProbingParsers()

◆ AppLayerProtoDetectPrepareState()

◆ AppLayerProtoDetectRegisterAlias()

◆ AppLayerProtoDetectRegisterProtocol()

◆ AppLayerProtoDetectReset()

◆ AppLayerProtoDetectSetup()

◆ AppLayerProtoDetectSupportedAppProtocols()

◆ AppLayerProtoDetectSupportedIpprotos()

◆ AppLayerProtoDetectUnittestCtxBackup()

◆ AppLayerProtoDetectUnittestCtxRestore()

◆ AppLayerProtoDetectUnittestsRegister()

◆ AppLayerRegisterExpectationProto()

◆ AppLayerRequestProtocolChange()

◆ AppProtoDetectListNames()

◆ SCAppLayerForceProtocolChange()

◆ SCAppLayerProtoDetectConfProtoDetectionEnabled()

◆ SCAppLayerProtoDetectConfProtoDetectionEnabledDefault()

◆ SCAppLayerProtoDetectPMRegisterPatternCI()

◆ SCAppLayerProtoDetectPMRegisterPatternCIwPP()

◆ SCAppLayerProtoDetectPMRegisterPatternCS()

◆ SCAppLayerProtoDetectPMRegisterPatternCSwPP()

◆ SCAppLayerProtoDetectPPParseConfPorts()

◆ SCAppLayerProtoDetectPPRegister()

◆ SCAppLayerRequestProtocolTLSUpgrade()